CodeAstro Ecommerce CVE-2026-14767

Q: What is the CVSS score of CVE-2026-14767?

CVE-2026-14767 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41777 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-05 cna@vuldb.com

GHSA-pj25-44r7-9g5g

PHP SQLi

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQL injection requiring customer-level authentication (PR:L); limited and scoped C/I/A impact with no scope change justified by database-only reach.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 20:51 vuln.today

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoice_no results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in CodeAstro Ecommerce Website 1.0 exposes the order confirmation endpoint to authenticated remote attackers who can manipulate the unsanitized invoice_no POST parameter to alter backend SQL queries. Exploitation is constrained to authenticated customer accounts (PR:L per CVSS 4.0 vector) but requires no additional configuration or user interaction. A public proof-of-concept has been released via GitHub Gist (E:P), lowering the technical bar for abuse despite a low CVSS 4.0 score of 2.1; no confirmed active exploitation or CISA KEV listing exists at time of analysis.

Technical ContextAI

CodeAstro Ecommerce Website 1.0 is a PHP-based e-commerce application. The vulnerable code path resides in /ecommerce-website-php/customer/confirm.php, a POST parameter handler where the invoice_no value is incorporated into a SQL query without parameterization or sanitization. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), the parent class encompassing SQL injection. PHP applications that build SQL queries via string concatenation rather than prepared statements are classically susceptible to this pattern. No CPE string was included in the provided data, so automated scanner matching cannot be confirmed from this input alone.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix is to refactor the SQL query construction in confirm.php to use parameterized queries or prepared statements (e.g., PDO with bound parameters), which eliminates the injection vector entirely with no functional side effects. As a compensating control, operators should deploy a Web Application Firewall rule targeting SQL injection patterns in POST body parameters to the /ecommerce-website-php/customer/confirm.php endpoint; note that WAF rules require tuning to avoid false positives on legitimate numeric invoice inputs. Additionally, restricting the application's database user to the minimum required privileges (e.g., SELECT and INSERT only, no DROP or schema-level access) limits the blast radius of a successful injection. The VulDB advisory is available at https://vuldb.com/vuln/376357 and the public proof-of-concept is published at https://gist.github.com/menelausx/2222914494e28e7d70f9a35af8fae824.